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AMENDMENTS TO THE CLAIMS; 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

LISTING OF CLAIMS 

1 (Previously Presented) A method for correlating a first sensor to a second 
sensor in an Intrusion detection system, the first and second sensors each maintaining 
belief over a number of possible states of the system, the method comprising the steps 
of: 

(a) transmitting to the first sensor information about the second sensor's belief 
state, said belief state indicating a state of at least one system resource or service; and 

(b) adjusting a prior belief state of the first sensor, said belief state indicating 
a state of at least one system resource or service, the adjustment based at least in part 
on the second sensor's belief state, 

2. (Original) The method of claim 1 wherein the first and second sensors are 
different types of sensors. 

3. (Original) The method of claim 2 wherein the first sensor is a probabilistic 
sensor. 

4. (Original) A method for reducing false alarms generated by an intrusion 
detection system when a monitored resource is degraded or compromised, the intrusion 
detection system having a first and second sensors each maintaining belief over a 
number of possible states of the system, the method comprising the steps of: 

(a) transmitting to the first sensor all or part of the belief of the second sensor 
regarding an apparent normal, degraded or compromised state of a monitored resource; 
and 

(b) adjusting a prior belief state of the first sensor so that an erroneous 
transaction with the degraded or compromised resource does not generate an alarm. 

5. (Original) A method for enhancing the sensitivity of an intrusion detection system 
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that monitors a plurality of computer system resources, the intrusion detection system 
having a first and second sensors each maintaining belief over a number of possible 
states of the system, the method comprising the steps of: 

(a) transmitting to the first sensor all or part of the belief of the second sensor 
regarding the existence or validity of services supported on monitored computer system 
resources; and 

(b) adjusting a prior belief state of the first sensor so that an attempted 
communication with a nonexistent system service or resource appears suspicious. 

6. - 9. (Cancelled) 
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